Warning: Permanently added '[localhost]:61026' (ECDSA) to the list of known hosts. 2026/01/18 00:03:31 fuzzer started 2026/01/18 00:03:31 dialing manager at localhost:42157 syzkaller login: [ 59.969972] cgroup: Unknown subsys name 'net' [ 60.044333] cgroup: Unknown subsys name 'cpuset' [ 60.057962] cgroup: Unknown subsys name 'rlimit' 2026/01/18 00:03:42 syscalls: 202 2026/01/18 00:03:42 code coverage: enabled 2026/01/18 00:03:42 comparison tracing: enabled 2026/01/18 00:03:42 extra coverage: enabled 2026/01/18 00:03:42 setuid sandbox: enabled 2026/01/18 00:03:42 namespace sandbox: enabled 2026/01/18 00:03:42 Android sandbox: enabled 2026/01/18 00:03:42 fault injection: enabled 2026/01/18 00:03:42 leak checking: enabled 2026/01/18 00:03:42 net packet injection: enabled 2026/01/18 00:03:42 net device setup: enabled 2026/01/18 00:03:42 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2026/01/18 00:03:42 devlink PCI setup: PCI device 0000:00:10.0 is not available 2026/01/18 00:03:42 USB emulation: enabled 2026/01/18 00:03:42 hci packet injection: enabled 2026/01/18 00:03:42 wifi device emulation: enabled 2026/01/18 00:03:42 802.15.4 emulation: enabled 2026/01/18 00:03:42 fetching corpus: 0, signal 0/0 (executing program) 2026/01/18 00:03:43 starting 8 fuzzer processes 00:03:43 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_ACCEPT(r7, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xa4, r8, 0x400, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:sshd_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x4008044) syz_genetlink_get_family_id$nl802154(&(0x7f0000000940), r7) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000009c0), r7) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x58, r9, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x8011) 00:03:43 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:03:43 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x34, 0x0, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x24000000) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000001140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001080)=""/18, 0x12, 0x0, &(0x7f00000010c0)=""/98, 0x62}, &(0x7f0000001180)=0x40) 00:03:43 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x58, r4, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x3, 0x25}}}}, [@NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_IE={0x20, 0x2a, [@ht={0x2d, 0x1a, {0x10, 0x0, 0x7, 0x0, {0x200, 0x6, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x3, 0x1}, 0x8, 0x5, 0x3}}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x801}, 0x40000) 00:03:43 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x70, r2, 0x20, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x7f}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r7, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:03:43 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000006c0), r1) sendmsg$NLBL_UNLABEL_C_STATICLIST(r7, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x84, r8, 0x2, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'netpci0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x32, 0x7, 'system_u:object_r:systemd_systemctl_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @empty}]}, 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x0) [ 71.101645] audit: type=1400 audit(1768694624.002:7): avc: denied { execmem } for pid=274 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 00:03:44 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x17}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x6}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xa}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x5}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0xc}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x11}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x2000010) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x6c, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4800}, 0x4850) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20081}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, r4, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x927b}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1000}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r5) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000480), r6) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f00000004c0)={0x2, 0x1, 0x2, 0x1, 0x7}) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x20000001) sendmsg$NLBL_UNLABEL_C_LIST(r5, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x28, r7, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bond\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000010}, 0x80) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r8, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x44, r1, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x14}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x3f}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x1}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x3}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x40) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x28, r7, 0x600, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000980)={{0x1, 0x0, 0x9, 0x2, 0x2571}}) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x7c, r7, 0x2, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x28, 0x7, 'system_u:object_r:udev_var_run_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @private=0xa010100}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:tape_device_t:s0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) 00:03:44 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f00000004c0)={0x7, "dd95be"}, 0x6) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000500)={r2}) [ 72.218056] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.222442] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.225624] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.236505] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.239183] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.350753] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 72.357497] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 72.359363] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 72.359409] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 72.362189] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 72.363620] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 72.365074] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 72.371110] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 72.372893] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 72.383001] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 72.384800] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 72.388541] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 72.392260] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 72.393654] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 72.410031] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 72.422148] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 72.424804] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 72.427217] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 72.428796] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 72.430124] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 72.431720] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 72.434249] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 72.435491] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 72.436129] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 72.436697] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 72.455498] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 72.457886] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 72.459530] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 72.468661] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 72.474564] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 72.475775] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 72.480067] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 72.484755] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 72.486018] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 72.489486] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 74.254433] Bluetooth: hci0: command tx timeout [ 74.381695] Bluetooth: hci2: command tx timeout [ 74.446306] Bluetooth: hci1: command tx timeout [ 74.509387] Bluetooth: hci6: command tx timeout [ 74.509444] Bluetooth: hci3: command tx timeout [ 74.509988] Bluetooth: hci4: command tx timeout [ 74.574217] Bluetooth: hci5: command tx timeout [ 74.574767] Bluetooth: hci7: command tx timeout [ 76.302939] Bluetooth: hci0: command tx timeout [ 76.430166] Bluetooth: hci2: command tx timeout [ 76.493362] Bluetooth: hci1: command tx timeout [ 76.557459] Bluetooth: hci4: command tx timeout [ 76.557856] Bluetooth: hci3: command tx timeout [ 76.558235] Bluetooth: hci6: command tx timeout [ 76.621350] Bluetooth: hci7: command tx timeout [ 76.621750] Bluetooth: hci5: command tx timeout [ 78.349318] Bluetooth: hci0: command tx timeout [ 78.477331] Bluetooth: hci2: command tx timeout [ 78.542226] Bluetooth: hci1: command tx timeout [ 78.606305] Bluetooth: hci6: command tx timeout [ 78.606703] Bluetooth: hci3: command tx timeout [ 78.607084] Bluetooth: hci4: command tx timeout [ 78.670305] Bluetooth: hci5: command tx timeout [ 78.670838] Bluetooth: hci7: command tx timeout [ 80.398314] Bluetooth: hci0: command tx timeout [ 80.525342] Bluetooth: hci2: command tx timeout [ 80.589321] Bluetooth: hci1: command tx timeout [ 80.653720] Bluetooth: hci4: command tx timeout [ 80.654123] Bluetooth: hci3: command tx timeout [ 80.654322] Bluetooth: hci6: command tx timeout [ 80.718459] Bluetooth: hci7: command tx timeout [ 80.718911] Bluetooth: hci5: command tx timeout [ 105.955601] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.959826] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.132844] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.133516] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.405418] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.406535] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.709455] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.710071] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.842496] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.843596] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.941814] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.942914] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.099014] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.099675] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.332109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.332772] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.351648] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.352223] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.447888] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.448523] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.811860] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.813580] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.904588] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.905218] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.004451] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.005078] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.052097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.052990] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.136771] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.138212] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.180092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.180974] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 00:04:31 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f00000004c0)={0x7, "dd95be"}, 0x6) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000500)={r2}) 00:04:31 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:04:31 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x70, r2, 0x20, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x7f}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r7, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:04:31 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x17}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x6}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xa}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x5}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0xc}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x11}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x2000010) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x6c, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4800}, 0x4850) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20081}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, r4, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x927b}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1000}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r5) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000480), r6) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f00000004c0)={0x2, 0x1, 0x2, 0x1, 0x7}) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x20000001) sendmsg$NLBL_UNLABEL_C_LIST(r5, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x28, r7, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bond\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000010}, 0x80) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r8, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x44, r1, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x14}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x3f}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x1}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x3}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x40) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x28, r7, 0x600, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000980)={{0x1, 0x0, 0x9, 0x2, 0x2571}}) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x7c, r7, 0x2, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x28, 0x7, 'system_u:object_r:udev_var_run_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @private=0xa010100}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:tape_device_t:s0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) 00:04:31 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000006c0), r1) sendmsg$NLBL_UNLABEL_C_STATICLIST(r7, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x84, r8, 0x2, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'netpci0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x32, 0x7, 'system_u:object_r:systemd_systemctl_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @empty}]}, 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 00:04:31 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x58, r4, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x3, 0x25}}}}, [@NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_IE={0x20, 0x2a, [@ht={0x2d, 0x1a, {0x10, 0x0, 0x7, 0x0, {0x200, 0x6, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x3, 0x1}, 0x8, 0x5, 0x3}}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x801}, 0x40000) 00:04:31 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x34, 0x0, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x24000000) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000001140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001080)=""/18, 0x12, 0x0, &(0x7f00000010c0)=""/98, 0x62}, &(0x7f0000001180)=0x40) 00:04:31 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_ACCEPT(r7, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xa4, r8, 0x400, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:sshd_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x4008044) syz_genetlink_get_family_id$nl802154(&(0x7f0000000940), r7) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000009c0), r7) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x58, r9, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x8011) 00:04:31 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x70, r2, 0x20, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x7f}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r7, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:04:31 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x34, 0x0, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x24000000) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000001140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001080)=""/18, 0x12, 0x0, &(0x7f00000010c0)=""/98, 0x62}, &(0x7f0000001180)=0x40) 00:04:31 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:04:31 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f00000004c0)={0x7, "dd95be"}, 0x6) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000500)={r2}) 00:04:40 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:04:40 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x58, r4, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x3, 0x25}}}}, [@NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_IE={0x20, 0x2a, [@ht={0x2d, 0x1a, {0x10, 0x0, 0x7, 0x0, {0x200, 0x6, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x3, 0x1}, 0x8, 0x5, 0x3}}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x801}, 0x40000) 00:04:40 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x17}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x6}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xa}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x5}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0xc}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x11}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x2000010) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x6c, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4800}, 0x4850) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20081}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, r4, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x927b}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1000}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r5) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000480), r6) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f00000004c0)={0x2, 0x1, 0x2, 0x1, 0x7}) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x20000001) sendmsg$NLBL_UNLABEL_C_LIST(r5, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x28, r7, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bond\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000010}, 0x80) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r8, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x44, r1, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x14}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x3f}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x1}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x3}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x40) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x28, r7, 0x600, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000980)={{0x1, 0x0, 0x9, 0x2, 0x2571}}) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x7c, r7, 0x2, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x28, 0x7, 'system_u:object_r:udev_var_run_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @private=0xa010100}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:tape_device_t:s0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) 00:04:40 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_ACCEPT(r7, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xa4, r8, 0x400, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:sshd_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x4008044) syz_genetlink_get_family_id$nl802154(&(0x7f0000000940), r7) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000009c0), r7) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x58, r9, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x8011) 00:04:40 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f00000004c0)={0x7, "dd95be"}, 0x6) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000500)={r2}) 00:04:40 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x34, 0x0, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x24000000) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000001140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001080)=""/18, 0x12, 0x0, &(0x7f00000010c0)=""/98, 0x62}, &(0x7f0000001180)=0x40) 00:04:40 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000006c0), r1) sendmsg$NLBL_UNLABEL_C_STATICLIST(r7, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x84, r8, 0x2, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'netpci0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x32, 0x7, 'system_u:object_r:systemd_systemctl_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @empty}]}, 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 00:04:40 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x70, r2, 0x20, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x7f}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r7, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:04:40 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f00000004c0)={0x7, "dd95be"}, 0x6) 00:04:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_ACCEPT(r7, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xa4, r8, 0x400, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:sshd_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x4008044) syz_genetlink_get_family_id$nl802154(&(0x7f0000000940), r7) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000009c0), r7) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x58, r9, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x8011) 00:04:41 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x34, 0x0, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x24000000) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:04:41 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000640), 0x2, 0x0) 00:04:41 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x17}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x6}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xa}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x5}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0xc}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x11}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x2000010) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x6c, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4800}, 0x4850) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20081}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, r4, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x927b}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1000}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r5) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000480), r6) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f00000004c0)={0x2, 0x1, 0x2, 0x1, 0x7}) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x20000001) sendmsg$NLBL_UNLABEL_C_LIST(r5, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x28, r7, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bond\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000010}, 0x80) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r8, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x44, r1, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x14}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x3f}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x1}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x3}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x40) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x28, r7, 0x600, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000980)={{0x1, 0x0, 0x9, 0x2, 0x2571}}) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x7c, r7, 0x2, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x28, 0x7, 'system_u:object_r:udev_var_run_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @private=0xa010100}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:tape_device_t:s0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) 00:04:41 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x70, r2, 0x20, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x7f}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:04:41 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000640), 0x2, 0x0) 00:04:41 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000006c0), r1) sendmsg$NLBL_UNLABEL_C_STATICLIST(r7, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x84, r8, 0x2, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'netpci0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x32, 0x7, 'system_u:object_r:systemd_systemctl_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @empty}]}, 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 00:04:41 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f00000004c0)={0x7, "dd95be"}, 0x6) 00:04:49 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x70, r2, 0x20, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x7f}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:04:49 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x58, r4, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x3, 0x25}}}}, [@NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_IE={0x20, 0x2a, [@ht={0x2d, 0x1a, {0x10, 0x0, 0x7, 0x0, {0x200, 0x6, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x3, 0x1}, 0x8, 0x5, 0x3}}]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x801}, 0x40000) 00:04:49 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000640), 0x2, 0x0) 00:04:49 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000006c0), r1) 00:04:49 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x34, 0x0, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x24000000) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:04:49 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000640), 0x2, 0x0) 00:04:49 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:04:49 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_ACCEPT(r7, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xa4, r8, 0x400, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:sshd_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x4008044) syz_genetlink_get_family_id$nl802154(&(0x7f0000000940), r7) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000009c0), r7) 00:04:49 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:04:50 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:04:50 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_ACCEPT(r7, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xa4, r8, 0x400, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:sshd_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x4008044) syz_genetlink_get_family_id$nl802154(&(0x7f0000000940), r7) 00:04:50 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000640), 0x2, 0x0) 00:04:50 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x70, r2, 0x20, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x7f}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:04:50 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:04:50 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:04:50 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:04:50 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000006c0), r1) 00:04:58 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:04:58 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000640), 0x2, 0x0) 00:04:58 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00'}) 00:04:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_ACCEPT(r7, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xa4, r8, 0x400, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:sshd_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x4008044) 00:04:58 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wlan1\x00'}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r5, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:04:58 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:04:58 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:04:58 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:04:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) 00:04:58 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:04:58 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x2000)=nil, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:04:58 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:04:58 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000540)={0x3}) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) 00:04:58 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x28, r0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0xe4c1010eb1ff96de) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:04:58 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) openat$null(0xffffffffffffff9c, &(0x7f0000001080), 0x100, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r5, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:06 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00'}) 00:05:06 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) shmget(0x3, 0x4000, 0x1000, &(0x7f0000ffa000/0x4000)=nil) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r4, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:06 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) 00:05:06 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) 00:05:06 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x120, r4, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5c}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x4951}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x70}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x1}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc8, 0x1, "c7505da71780a32cf060b4082295c1bb41cd0d0395a953b512f8bb0a9b07e9b19383afc8afd6afef449dd6193abeda77349705ade4207e33bfde828c94284806ab92c0c3ffac099c4b12e06a306699be1dbfecc5eaa8c10e11c4a3f8f3059ce27696c111dfa95003313392c27b1b0d17e90346258e170c89224c655f3264802e8817ef68f4b5679fa525e34c8f2911e4de60643da4a0cf4d7d653305d727afc6c6e1c71db8e8af8d9aa9638b149d654bcd6a0709b3d8b1d5947b3c27f053af56afc3b8e9"}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40884}, 0x1) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r5, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:06 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:05:06 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:06 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:06 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000300)={0x7, "7550ec"}, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r4, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:06 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) 00:05:06 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:05:06 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:06 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), 0xffffffffffffffff) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r4, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:06 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:06 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:07 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) 00:05:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) 00:05:15 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r5}) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000640), 0x2, 0x0) 00:05:15 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = getpid() getpgrp(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:15 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000dc0)={0x1, 0x7fffffff, 0x1}, &(0x7f0000000e00)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r4, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:15 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:15 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:15 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) 00:05:15 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00'}) 00:05:15 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) getpgrp(0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r4}) 00:05:15 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:15 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:15 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) getpid() r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:15 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) getpgrp(0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r4}) 00:05:15 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x4f}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x20044000}, 0x4000044) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r4, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:15 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = getpgrp(0x0) getpgrp(r4) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r5, &(0x7f0000000640), 0x2, 0x0) 00:05:23 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:23 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00'}) 00:05:23 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/132, 0x84, 0x7f, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:23 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) getpgrp(0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r4, &(0x7f0000000640), 0x2, 0x0) 00:05:23 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) getpgrp(0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r4}) 00:05:23 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a40), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:23 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0xfffffffb, 0x64}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x400) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r4, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:23 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xffffbafc, 0x6d}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4c841}, 0x2000014) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) 00:05:23 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r4}) 00:05:23 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:23 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) clock_gettime(0x4, &(0x7f00000001c0)) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:23 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r4, &(0x7f0000000640), 0x2, 0x0) 00:05:23 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x13) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r4}) 00:05:23 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r3, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:23 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r1 = getpgrp(r0) sched_rr_get_interval(r1, &(0x7f0000000180)) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:23 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x2020020}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x50, r3, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x200, 0x22}}}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x68}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0x1c}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000000}, 0x2004c004) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:23 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:31 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs2/custom1\x00', 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00'}) 00:05:31 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r3}) 00:05:31 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, r2, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x7}, {0x20, 0x1}, {0xff, 0x6}, {0x20}, {0x28, 0x5}, {0x9, 0x3}, {0x9, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x80, 0x6}, {0x2}, {0x4, 0x1}], "579f75923a11b2a7"}}, @NL80211_ATTR_QOS_MAP={0xc, 0xc7, {[], "e9ee119a4e9c6d5b"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xff, 0x3}, {0x7, 0x2}, {0x6, 0x7}, {0x9, 0x5}, {0x9, 0x6}, {0x8, 0x7}, {0xff, 0x3}, {0x9, 0x1}, {0x8}, {0x3f, 0x5}, {0x6, 0x1}, {0x48, 0x4}, {0x1, 0x1}, {0x2, 0x6}, {0x81, 0x5}, {0x4, 0x3}, {0x1}], "c1392f15d97e0ca9"}}]}, 0x74}, 0x1, 0x0, 0x0, 0x6}, 0x4000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r3, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:31 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r3, &(0x7f0000000640), 0x2, 0x0) 00:05:31 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) 00:05:31 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:31 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:31 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) getpgrp(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:31 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r3}) 00:05:31 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) getpgrp(0x0) mmap$usbmon(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x8030, 0xffffffffffffffff, 0x5) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:31 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r3, &(0x7f0000000640), 0x2, 0x0) 00:05:31 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) getpgrp(0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:31 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:31 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r3}) 00:05:31 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r3, &(0x7f0000000640), 0x2, 0x0) 00:05:31 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:39 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00'}) 00:05:39 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r3, &(0x7f0000000640), 0x2, 0x0) 00:05:39 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r2, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:39 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r5) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:39 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:39 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r3}) 00:05:39 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) [ 186.568399] [ 186.568767] ===================================== [ 186.569593] WARNING: bad unlock balance detected! [ 186.570415] 6.19.0-rc5-next-20260116 #1 Not tainted [ 186.571255] ------------------------------------- [ 186.572075] syz-executor.4/4279 is trying to release lock (rcu_read_lock) at: [ 186.573334] [] __wait_on_freeing_inode+0x105/0x350 [ 186.574450] but there are no more locks to release! [ 186.580258] [ 186.580258] other info that might help us debug this: [ 186.581550] 4 locks held by syz-executor.4/4279: [ 186.582273] #0: ffff88800f7de3f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400 [ 186.583620] #1: ffff8880096216f0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400 [ 186.585161] #2: ffff88800f6fa950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0 [ 186.586534] #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890 [ 186.587939] [ 186.587939] stack backtrace: [ 186.588642] CPU: 0 UID: 0 PID: 4279 Comm: syz-executor.4 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) [ 186.588671] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 186.588683] Call Trace: [ 186.588691] [ 186.588699] dump_stack_lvl+0xca/0x120 [ 186.588742] ? __wait_on_freeing_inode+0x105/0x350 [ 186.588770] print_unlock_imbalance_bug+0x118/0x130 [ 186.588798] ? __wait_on_freeing_inode+0x105/0x350 [ 186.588826] lock_release+0x1ee/0x270 [ 186.588855] __wait_on_freeing_inode+0x10a/0x350 [ 186.588883] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 186.588914] ? __pfx_var_wake_function+0x10/0x10 [ 186.588947] ? lock_is_held_type+0x9e/0x120 [ 186.588969] insert_inode_locked+0x25f/0x890 [ 186.589002] __ext4_new_inode+0x223d/0x4cd0 [ 186.589034] ? __pfx___ext4_new_inode+0x10/0x10 [ 186.589062] ? __pfx___dquot_initialize+0x10/0x10 [ 186.589097] ? __pfx_avc_has_perm+0x10/0x10 [ 186.589126] ext4_symlink+0x623/0xb40 [ 186.589162] ? __pfx_ext4_symlink+0x10/0x10 [ 186.589192] ? security_inode_permission+0x72/0xe0 [ 186.589218] vfs_symlink+0x44b/0x840 [ 186.589249] filename_symlinkat+0x158/0x440 [ 186.589277] ? __pfx_filename_symlinkat+0x10/0x10 [ 186.589303] ? strncpy_from_user+0x21b/0x2f0 [ 186.589335] __x64_sys_symlink+0x82/0x110 [ 186.589361] do_syscall_64+0xbf/0x420 [ 186.589386] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.589410] RIP: 0033:0x7f379e7dc427 [ 186.589427] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 186.589448] RSP: 002b:00007ffdf198e838 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 [ 186.589469] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f379e7dc427 [ 186.589484] RDX: 00007ffdf198e913 RSI: 00007f379e83702f RDI: 00007ffdf198e900 [ 186.589498] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffdf198e6d0 [ 186.589512] R10: 00007ffdf198e587 R11: 0000000000000202 R12: 0000000000000001 [ 186.589526] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffdf198e900 [ 186.589546] [ 186.619334] ------------[ cut here ]------------ [ 186.620063] WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#0: syz-executor.4/4279 [ 186.621741] Modules linked in: [ 186.622298] CPU: 0 UID: 0 PID: 4279 Comm: syz-executor.4 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) [ 186.623836] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 186.625117] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 [ 186.626002] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9 [ 186.628766] RSP: 0018:ffff88806ce08cb8 EFLAGS: 00010086 [ 186.629579] RAX: 00000000ffffffff RBX: ffff88801ad41b80 RCX: ffffffff81893bc4 [ 186.630659] RDX: 0000000000000000 RSI: ffffffff81893bdb RDI: ffff88801ad41f7c [ 186.631742] RBP: ffff88801ad41b80 R08: 0000000000000000 R09: 0000000000000000 [ 186.632849] R10: 0000000000000000 R11: 00000000000003ec R12: ffff88801ad41b80 [ 186.633940] R13: 0000000000000000 R14: ffff88806ce379c0 R15: ffff88806ce37a20 [ 186.635023] FS: 0000555558933400(0000) GS:ffff8880e5342000(0000) knlGS:0000000000000000 [ 186.636237] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 186.637135] CR2: 00005555623df708 CR3: 000000000c125000 CR4: 0000000000350ef0 [ 186.638229] Call Trace: [ 186.638686] [ 186.639905] sched_tick+0x232/0x6e0 [ 186.642426] update_process_times+0x116/0x210 [ 186.644369] tick_nohz_handler+0x4ff/0x8c0 [ 186.645383] ? __pfx_sched_balance_rq+0x10/0x10 [ 186.646756] ? __pfx_tick_nohz_handler+0x10/0x10 [ 186.648135] ? lock_release+0x1c7/0x270 [ 186.649757] ? __pfx_tick_nohz_handler+0x10/0x10 [ 186.651482] __hrtimer_run_queues+0x654/0xbb0 [ 186.655355] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 186.656249] ? ktime_get_update_offsets_now+0x252/0x3c0 [ 186.659653] hrtimer_interrupt+0x369/0x830 [ 186.663825] __sysvec_apic_timer_interrupt+0xbb/0x300 [ 186.665340] sysvec_apic_timer_interrupt+0x6b/0x80 [ 186.666454] [ 186.666807] [ 186.667509] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 186.668495] RIP: 0010:is_valid_bugaddr+0x4/0x90 [ 186.669336] Code: 0f 0b 90 e9 6d ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 <41> 54 55 53 48 89 fb e8 60 a0 4b 00 48 bd 00 f0 ff ff ff 7f 00 00 [ 186.672089] RSP: 0018:ffff88804598f748 EFLAGS: 00000293 [ 186.672916] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff84c55526 [ 186.674010] RDX: ffff88801ad41b80 RSI: ffffffff84c54a85 RDI: ffffffff815d742f [ 186.675096] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000 [ 186.676187] R10: 0000000000000004 R11: 0000000000000000 R12: ffffffff815d742f [ 186.677294] R13: ffff88804598f8f8 R14: 0000000000000002 R15: 000000000000000b [ 186.678907] ? __rcu_read_unlock+0x25f/0x5c0 [ 186.680958] ? report_bug+0x66/0x120 [ 186.681842] ? __report_bug+0x375/0x5b0 [ 186.682581] ? __rcu_read_unlock+0x25f/0x5c0 [ 186.684515] __report_bug+0x37d/0x5b0 [ 186.685996] ? _printk+0xbe/0xf0 [ 186.687003] ? __pfx___report_bug+0x10/0x10 [ 186.689733] ? __is_insn_slot_addr+0x140/0x290 [ 186.691268] ? __is_insn_slot_addr+0x11b/0x290 [ 186.693161] ? __rcu_read_unlock+0x25f/0x5c0 [ 186.694490] report_bug+0x7c/0x120 [ 186.695405] ? __rcu_read_unlock+0x25f/0x5c0 [ 186.696397] handle_bug+0x2e8/0x4f0 [ 186.697319] ? trace_hardirqs_off_finish+0xe3/0x110 [ 186.699264] exc_invalid_op+0x35/0x80 [ 186.700572] asm_exc_invalid_op+0x1a/0x20 [ 186.701386] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 [ 186.702269] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9 [ 186.705027] RSP: 0018:ffff88804598f9a0 EFLAGS: 00010286 [ 186.705843] RAX: 00000000ffffffff RBX: ffff88801ad41b80 RCX: ffffffff815660f7 [ 186.706924] RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff88801ad41f7c [ 186.708005] RBP: ffff88801ad41b80 R08: 0000000000000000 R09: fffffbfff0ba7040 [ 186.709086] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88801ad41b80 [ 186.710160] R13: 0000000000000001 R14: ffffffff85c0f360 R15: ffff88801f0b6bf0 [ 186.713184] ? nbcon_cpu_emergency_exit+0x117/0x1c0 [ 186.714257] ? nbcon_cpu_emergency_exit+0x120/0x1c0 [ 186.717149] __wait_on_freeing_inode+0x10f/0x350 [ 186.718413] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 186.720399] ? __pfx_var_wake_function+0x10/0x10 [ 186.722662] ? lock_is_held_type+0x9e/0x120 [ 186.724674] insert_inode_locked+0x25f/0x890 [ 186.727648] __ext4_new_inode+0x223d/0x4cd0 [ 186.732181] ? __pfx___ext4_new_inode+0x10/0x10 [ 186.734429] ? __pfx___dquot_initialize+0x10/0x10 [ 186.735824] ? __pfx_avc_has_perm+0x10/0x10 [ 186.739075] ext4_symlink+0x623/0xb40 [ 186.743201] ? __pfx_ext4_symlink+0x10/0x10 [ 186.745058] ? security_inode_permission+0x72/0xe0 [ 186.748035] vfs_symlink+0x44b/0x840 [ 186.750390] filename_symlinkat+0x158/0x440 [ 186.752470] ? __pfx_filename_symlinkat+0x10/0x10 [ 186.753862] ? strncpy_from_user+0x21b/0x2f0 [ 186.757328] __x64_sys_symlink+0x82/0x110 [ 186.758681] do_syscall_64+0xbf/0x420 [ 186.760153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.761129] RIP: 0033:0x7f379e7dc427 [ 186.761823] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 186.764588] RSP: 002b:00007ffdf198e838 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 [ 186.765745] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f379e7dc427 [ 186.766839] RDX: 00007ffdf198e913 RSI: 00007f379e83702f RDI: 00007ffdf198e900 [ 186.767921] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffdf198e6d0 [ 186.769010] R10: 00007ffdf198e587 R11: 0000000000000202 R12: 0000000000000001 [ 186.770095] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffdf198e900 [ 186.774879] [ 186.775250] irq event stamp: 441 [ 186.775771] hardirqs last enabled at (441): [] irqentry_exit+0x17b/0x650 [ 186.777159] hardirqs last disabled at (440): [] sysvec_apic_timer_interrupt+0xf/0x80 [ 186.778705] softirqs last enabled at (434): [] kernel_fpu_end+0x59/0x70 [ 186.780090] softirqs last disabled at (432): [] kernel_fpu_begin_mask+0x1bb/0x300 [ 186.781588] ---[ end trace 0000000000000000 ]--- 00:05:39 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r2}) 00:05:39 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) mq_timedsend(0xffffffffffffffff, &(0x7f0000000900)="b50903c2f950d55a329e69df8957a41b06579eb24a6f5e3dc80b921e226dea0357d12912fa16cd4faa84d17b666930dd7f6722334327ea801142a1f26d7b6b8e1b8a82b0358945499ea5ad55f9a058226f6615533806c36c571bd6e216c15c0db9df4648af285b6869dad3cfcb39f87b957218", 0x73, 0x3f, &(0x7f0000000980)={0x0, 0x989680}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r2, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:39 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:39 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r5) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:39 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840), 0x80600, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:39 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r3, &(0x7f0000000640), 0x2, 0x0) 00:05:39 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x45}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:39 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x14c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0xcb, 0x1}, {0x0, 0x3}, {0x5, 0x3}], "dd0a6b0f241d92aa"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0xec, 0x1}, {0x1, 0x7}, {0x0, 0x5}, {0x1, 0x2}, {0xc0}, {0xff, 0x2}, {0x8, 0x1}, {0x40, 0x7}, {0x1f, 0x2}, {0x1, 0x4}, {0xff, 0x5}, {0x33}, {0x80, 0x7}, {0x67, 0x1}, {0x8c, 0x1}, {0x1b, 0x1}, {0x4, 0x4}, {0x20, 0x1}, {0x4, 0x7}], "bb03c0c8a732769f"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x1, 0x5}, {0x53, 0x6}, {0x1f, 0x4}, {0xff, 0x5}, {0x0, 0x3}, {0xa9}, {0x40, 0x6}, {0x4, 0x3}, {0x7, 0x2}, {0x92, 0x3}, {0x2, 0x6}, {0x8, 0x7}, {0x1f}, {0x6, 0x7}], "e2831def54f48d63"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x5}, {0x3f}, {0x9, 0x1}, {0x50, 0x4}, {0xff, 0x7}, {0x7, 0x5}], "b918946ae21b659e"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x1, 0x6}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x1}, {0x8, 0x2}, {0x3f, 0x5}, {0x7, 0x7}, {0x80}, {0xff, 0x4}, {0x0, 0x5}, {0x20, 0x1}, {0x0, 0x4}], "4d7f92bad637feb7"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1f, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x40, 0x2}], "b44516e979581353"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x80, 0x5}, {0xfa, 0x2}, {0x40, 0x6}, {0x0, 0x7}], "8f4f92d5bd4e06f3"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x1}, {0x6, 0x7}, {0x4, 0x7}, {0x0, 0x1}, {0x71}, {0x8, 0x6}, {0xff, 0x2}, {0x0, 0x5}, {0xff, 0x7}, {0x1, 0x6}, {0x4, 0x1}, {0x2c, 0x5}, {0x80, 0x4}, {0x4}, {0x5c, 0x4}, {0x3f, 0x7}, {0x80, 0x4}], "decccbd1e75be6e8"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x6}, {0x1}, {0x1, 0x6}, {0x3f, 0x6}, {0x3, 0x7}, {0x5, 0x1}, {0x79, 0x4}, {0x1}, {0x40, 0x7}, {0xfa, 0x3}, {0x9, 0x3}, {0x7e, 0x1}, {0x0, 0x7}, {0x78, 0x5}, {0x3, 0x6}, {}, {0x6}, {0x1f}, {0x8}, {0x6, 0x5}], "0f198fada629100b"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r2, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:47 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r2}) 00:05:47 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, 0x0, 0x24000000) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r5) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:47 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x810, 0xffffffffffffffff, 0x10000000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) 00:05:47 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'team0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8048015}, 0x400c0c4) syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:47 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r3, &(0x7f0000000640), 0x2, 0x0) 00:05:47 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x10081, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100)="3b2e7acc9f9ed01640a38b15ec4aad8b02c820d1b900efa5389d23e0787a098e1f5f32b9207794f0869f99c8ad7c3f19226102d8bb4322dbc551878f46333b05da6580b738c711d5ce0d813a700add69a76bc023fd1a7b8eb0243f91c99ef7ad540121cc97a6bf2cc3bdfbb029075629ca9beea89d9fde711590f2b3a6e2944a2b1c545542270143daf94bb13a94b286dda74cf0b29b5f8a8ff177a79c84d1381084e4ccee1359613347ba56ec2d790cfae847691ab9d56bc2e1265559681b64894c738fe920e901089a19def88257bcfc12315231ce797f551b", 0xda, r2}, 0x68) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) connect$bt_sco(0xffffffffffffffff, &(0x7f00000002c0), 0x8) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000300)={{0x0, 0x0, 0x8, 0x3, 0x10000}, 0x3, 0x80000000, 'id1\x00', 'timer0\x00', 0x0, 0x5, 0xbb2, 0x0, 0x1f9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000400)={0x2}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0x2, 0x7, {0x7, 0x10, "9c498393fc"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x20, 0x1, 0xf6, "782b81a63126f602aeca787a69267411a68a98069bfc29ce6ff6d61b0ba0aa324104870c2255bc5baa6925a9c30dfd57a508823f69b404d4ce8c7c46c22829812289747a04e52ff4233c841bd8ede0596127899833b02c55ce40c46d8152b77f1574fd21d9c2370f24b358c421cdeba6701baad27366010fa6af707d44ed18921ef2eaa782ae1c86dfe72adbea05f6d80360a3bfc4c6e51d912c508208798b83e3b92a3f978fa56648df3bbd0653ab05622032c8fddca44af99d02a342748ad13c3fd01733c100b8c806064a8881ac5c7f10420eb167fabe10d083666d9a72874c4fd0d95b029c8acfed174f9104ae6901e5db1e0d03"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x5, 0x8001, 0x5, 0x401, 0x6, 0xfffc, 0x5, 0x8, 0x8, 0x1, 0x1fc8, 0x6}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000700)={0x20, 0x83, 0x2}, &(0x7f0000000740)={0x20, 0x87, 0x2, 0xe27f}, &(0x7f0000000780)={0x20, 0x89, 0x2, 0x1}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000008c0)={0x40, 0x0, &(0x7f0000000840)=[@enter_looper, @clear_death={0x400c630f, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}, @acquire_done={0x40106309, 0x2}, @exit_looper, @register_looper, @register_looper], 0x0, 0x0, &(0x7f0000000880)}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan1\x00'}) 00:05:47 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xcf17}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x4}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xbb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x5) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r2, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:47 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan0\x00'}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r1, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:47 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r2}) 00:05:47 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) 00:05:47 executing program 1: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0}) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r2, &(0x7f0000000640), 0x2, 0x0) 00:05:47 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) getpgrp(0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:48 executing program 6: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)='6', 0x1}, 0x68) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='./binderfs2/binder1\x00') getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, @none}, &(0x7f0000000240)=0xe, 0x180000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xa0, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x164, 0x11}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="437b3b7242c818e556dbdb966b291543"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4356d701}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fdb04c4198e1b1887ea6289706f0b3a2"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85ba28b8d7e2fd90"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dc512c1e628000f7a088b3e998a8289"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7ff}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2435}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4048010}, 0x40800) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/custom0\x00', 0x800, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000500), 0x101080, 0x0) io_uring_setup(0xff0, &(0x7f0000000580)={0x0, 0x9817, 0x8, 0x1, 0x3d0, 0x0, r1}) 00:05:48 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x628, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x3}, @NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}]]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) r2 = socket(0x3, 0x6, 0x400) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, 0x0, 0x801, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008008}, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4e40, 0x62}}}}, ["", ""]}, 0x28}}, 0x24004015) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, r4, 0x200, 0x0, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x3c}}, 0x2000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r5) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000007c0), 0xffffffffffffffff) 00:05:48 executing program 3: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r1) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r1) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x94, r2, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:systemd_logger_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'gretap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x40000) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), r3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r4, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:05:48 executing program 2: sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2e}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000180)={0x328, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x20}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fb23078ff13baa52266ddc29a301b9fe53005a6598da60b99e06142dcec36074"}]}, @NL80211_ATTR_REKEY_DATA={0xe8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffc1}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="61490af133dd3d9f1c84dee34341ff0888ca7f873a0057ddbe1b4357e9dcc748"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0ae39883f6eef70007a13a639833078ce7135d734cfb037a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="275dea7595fcd82de7e39978d60d4364"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6c1724a1cac0a1d9af8506a4ea34c71877b96cbfaf57cee1a3f23b7c0f47c508"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="a28095bf81875cd81d4f9dce101a5e995bdd4da7310cc682"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "529dc0552c9e4130"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d7110f1191089d33"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f3ddccf611f9b5602c34ef37f9dbd30bf6d8bbbcfb01119"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="76c1c6f839a4615140ad03573fa15082"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "de913f9459283cb0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "a92dd95ef74aa69b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5963246cb50c3524929d810381007271"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f193bf18583a25457fb3c9914a0c3a9b69dbc55282d7e6fc86dc2fbb8e69b03b"}]}, @NL80211_ATTR_REKEY_DATA={0xb4, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "23325a1c7dffd45a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="484c651c327d3c08a75861ee18d8b3a0"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7fd468601a7267bc3abd12f6bd8c993abca5dcc0ad9fe582"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1477ad35c57d9ef8"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b720c96543a425164fd1c5212c4458ca"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa0d}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="426238cca70e6cac0fc8a842e9d1f99e904da6b04bee63aa170ef10a938dba00"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "04c9f2721898a82e"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03642fc380601ffffff465beaae6d8b2f7a40c330c0b326b"}]}, @NL80211_ATTR_REKEY_DATA={0x14, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4416785df068adce"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4c566e3686330d7a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fadd410dd30ae15707cbde126cf7d4625f513a41cf512071"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c93ec8732d4146bff6bfcc636de03628b5cbb47f7a1ed469c9d6a7d4ca7d8a6e"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="f574d46cdae479cd40ade926c79979876bf730bb4af2525b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dd03b20dc7e5e978cecd5846fccf4b2b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3b67ea730c66d59d947ab2875dfe743c20ab2505bba533edb7f31b3e5ffb6665"}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x40010}, 0x200080c0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_VERSION(r1, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0x8c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x4004815) 00:05:48 executing program 7: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)="2379f947baf86ed7866b29deb949f7dbfcc38b9bbd60a6d58ccd67cc60a54253bdfa9120b77474783b68d43908f58ec56456ac3d5ea90c33fdae8a244fa83b7747df2e7eca5046ff02769655b73621b75774d6a0a65d68af043472ffcce2d2ae5685a17ab5b436cb78875c512c005e8c0d8a74bbc770371e28b9dec362f971c5638755469158b734625c7a0f356c41d2333a6a7d55fb05c3f514d27f086e7474d62494f4a2faa95a17dc3f202a249b82378fb253b3f79f745cd4397359285cdedf1d9eb17af3a9e504d09f5df5d4ef356f2a8a53bed9e7b946e1ba28d9c04ed72804214d6a534c44ea946174c0124503ff57b5420ddc", 0xf6}, 0x68) shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) getpgrp(0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x1c}}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0x26}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004000) 00:05:48 executing program 5: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c0}, 0x20008000) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfff, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xf}, @NL80211_ATTR_ADMITTED_TIME={0x6}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x1f}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000004}, 0x880) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x80) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0xd0) syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000e00)={0x5c, 0x0, &(0x7f0000000cc0)=[@clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000c00)={@ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/130, 0x82, 0x2, 0x11}, @fda={0x66646185, 0x3, 0x1, 0xc}, @fda={0x66646185, 0x3, 0x1, 0x12}}, &(0x7f0000000c80)={0x0, 0x28, 0x48}}}], 0xbf, 0x0, &(0x7f0000000d40)="ee3abda61e29fa4a37a7d420497d701c401ef8192043607121455a9cd4e27c9bbd5f14152fa44e7b7dea977d3f0181eadbc3dc56145c7877f34822c3240ab15e578b27a42ba9217ab3b475c1ca10f8768d07611820bbfc41bbcfda6e9f900b6f15f39db04288918b9b60c33b1444d0a1e4720c1a65cf0d09f7d2bf62909a9d818205d247e82f47edea6911202e3d18aea74eee58a45d8957499e13eaa2165a6a6602362278f821ad39565e155e204751d753a0315079a82565140391205edc"}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000001040), 0x12001, 0x0) [ 196.238506] Bluetooth: hci7: command 0x0406 tx timeout [ 196.239383] Bluetooth: hci0: command 0x0406 tx timeout [ 196.240153] Bluetooth: hci4: command 0x0406 tx timeout [ 196.240977] Bluetooth: hci3: command 0x0406 tx timeout [ 196.241774] Bluetooth: hci6: command 0x0406 tx timeout [ 196.242587] Bluetooth: hci5: command 0x0406 tx timeout [ 196.243388] Bluetooth: hci2: command 0x0406 tx timeout [ 196.244141] Bluetooth: hci1: command 0x0406 tx timeout VM DIAGNOSIS: 00:05:39 Registers: info registers vcpu 0 RAX=000000000000006c RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff82975135 RDI=ffffffff889c19e0 RBP=ffffffff889c19a0 RSP=ffff88804598f4a8 R8 =0000000000000000 R9 =ffffed1001766046 R10=000000000000006c R11=0000000020747562 R12=000000000000006c R13=0000000000000010 R14=ffffffff889c19a0 R15=ffffffff82975120 RIP=ffffffff8297518d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555558933400 00000000 00000000 GS =0000 ffff8880e5342000 00000000 00000000 LDT=0000 fffffe6d00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00005555623df708 CR3=000000000c125000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84d1a2ce RDX=fffffbfff0b82d11 RSI=0000000000000004 RDI=ffffffff85c16880 RBP=ffffffff85c16880 RSP=ffff88803f9e7950 R8 =0000000000000000 R9 =fffffbfff0b82d10 R10=ffffffff85c16883 R11=0000000000000000 R12=1ffff11007f3cf2b R13=0000000000000003 R14=fffffbfff0b82d10 R15=ffff88803f9e7988 RIP=ffffffff84d1a460 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00005555623df400 00000000 00000000 GS =0000 ffff8880e5442000 00000000 00000000 LDT=0000 fffffe6a00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00005555749b5c58 CR3=0000000046b23000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000